Configuration

Every default is the restrictive one; a backend whose point is isolation must not be safe only after configuration.

Key	Default	Meaning
`dockerPath`	`docker`	Container CLI. Anything argv-compatible with `docker run`.
`image`	`node:22-alpine`	Needs a `node` on `PATH` and nothing else.
`network`	`none`	Docker network mode. The main reason to use this backend.
`memory`	`512m`	Memory ceiling; an overrun is an OOM kill reported as `worker-exit`.
`cpus`	`1`	Kernel-enforced CPU quota.
`pidsLimit`	`128`	Process ceiling: a fork bomb hits it, not the host.
`user`	`65534:65534`	`nobody:nogroup`. Empty uses the image default.
`readOnlyRootfs`	`true`	Read-only root, with a tmpfs at `/tmp`.
`tmpfsMb`	`64`	Size of that tmpfs.
`workspacePath`	`''`	Absolute host path to mount at `/workspace`. Empty mounts nothing.
`workspaceReadOnly`	`true`	Mount the workspace read-only.
`extraArgs`	`[]`	Extra `docker run` flags. An escape hatch that can weaken every default above.
`maxWallMs`	`120000`	Wall-clock ceiling for one run, including container start.
`maxOutputBytes`	`4194304`	Combined cap on logs plus completion value.

Programs that must read project files need a mount:

- id: code-runtime-container
  config:
    workspacePath: /Users/me/projects/app
    workspaceReadOnly: true
    # …restate the rest; a patch replaces a row's whole config

dsh-code-runtime-container

AI 分析

安裝

說明文件

Configuration